Statement of Requirements.pdf

Statement of Requirements QPS Software Annual Maintenance Renewal and New License Purchase Requisition Number: NC-NJ1000-23-01205

1. Introduction

NOAA’s Office of Coast Survey (OCS) manages the production of NOAA nautical charts and its nautical data collection and information programs. This integrated suite of programs in hydrography and cartography helps protect life and property, supports economic growth and development, and protects the environment, in addition to the overall mission of promoting safe navigation.

Office of Coast Survey’s IT Services Branch supports and manages the hardware, software, licenses, electronic system security, business applications, projects, and other IT-related endeavors required by more than 300 employees of Coast Survey working throughout the United States.

Quality Positioning Services, Inc. (QPS) Fledermaus and Qimera software is an industry standard for processing and visualization of hydrographic survey data, and is mission critical for NOAA’s production of high-quality bathymetry and backscatter data to satisfy cross-organizational ocean mapping requirements (“map once, use many times”). NOAA’s hydrographic fleet currently has 22 licenses of QPS software in use, and has a continued requirement to access critical security patches, new software releases and updates, feature enhancements, and technical support for this mission-essential software.

2. Scope of Work

An annual maintenance renewal contract is required for QPS Fledermaus and Qimera software packages. This renewal includes Office of Coast Survey (Coast Survey Staff, Coast Survey Development Laboratory, Hydrographic Surveys Division, and Navigation Services Division) and all NOAA Office of Marine and Aviation Operations (OMAO) hydrographic survey platforms. To satisfy data processing needs, we must continue the annual maintenance for 22 total FMGT licenses and required additional software (i.e., Qimera)/add-ons, which includes 16 perpetual licenses and 6 subscription licenses.

2.1 Covered Service Items

The following service items shall be provided to NOAA for all software products covered under the annual maintenance renewal contract (as defined in Section 2.2, Covered Software Products):

● Critical software security patches

● Software updates

● New software version releases for subscription-based licenses and included updates for perpetual licenses

● Feature enhancements

● Technical support

Statement of Requirements – QPS Fledermaus/Qimera PR # NC-NJ1000-23-01205

2.2 Covered Software Products

The following software packages shall be covered under the annual maintenance renewal contract, where applicable:

• Qimera o Optional Add-Ons: TU Delft, ENC Plus

• Fledermaus

• FMGT

o Optional Add-On: HIPS I/O

• FMMidwater

• Qinsy

2.3 Maintenance on Existing Perpetual & Subscription Licenses

The following existing licenses shall be covered under the annual maintenance renewal contract:

Software Package Type Number of

Licenses License IDs Fledermaus + FMGT + FMMidwater Perpetual 6 5203360, 5203815, 5200905, 5201745, 5203998, 5200544

Qimera + QMMidwater + FMGT + Add-Ons: ENC Plus + Tu Delft

Perpetual 4 5202488, 5200317, 5200319, 5200320

FMGT Perpetual 6 5201746, 5203357, 5203358, 5203359, 5201967, 5201968

Qimera + FMGT + Add-On: ENC Plus

+ HIPS I/O

Subscription 6 5201965, 5202127, 5203814, 5203999, 5200545, 5201964

Note: This list includes perpetual licenses owned by NOAA Office Coast Survey as of May 4, 2023.

3. Specifications

For QPS Fledermaus and Qimera software maintenance and subscriptions, an Enterprise Licensing Agreement is required that includes access to licenses of the software as described in Section 2, Scope of Work. This agreement shall utilize single license keys and license instances. The licenses can only be distributed within NOAA Office of Coast Survey (Coast Survey Staff, Coast Survey Development Laboratory, Hydrographic Surveys Division, and Navigation Services Division) and NOAA Office of Marine and Aviation Operations hydrographic survey platforms.

4. Period of Performance

One Year: October 1, 2023, through September 30, 2024

5. Government Points of Contact

Technical Task Lead LTJG S. Harper Umfress 7600 Sand Point Way NE, Building 3 Seattle, WA 98115 Phone: (425) 666-9657; Email: Samuel.umfress@noaa.gov

Contracting Officer’s Representative (COR) Teresa Fleisher 1315 East-West Highway, N/CS1 Silver Spring, MD 20910 Phone: 304-506-6343; Email: Teresa.Fleisher@noaa.gov

6. Statement of IT Security Requirements

The Assessment and Authorization (A&A) requirements of Clause 48 CFR 1352.239-72 do not apply, and a Security Accreditation Package is not required.

The following is a list of relevant information the Department of Commerce (DOC) Information Technology (IT) Security takes into consideration when assessing the security requirements and risk for procuring IT products and services.

a) The Contractor shall only supply Information Technology (e.g., hardware, software, firmware, etc.) and/or product license and shall not require the use of any contractor owned equipment.

The contractor will not have remote access to any government owned equipment. The Contractor shall ensure the acquiring Information Technology provided disables “phone home” or similar capabilities.

b) Product support and supporting documentation allows for the sanitization of the acquiring

Information Technology and/or product license upon the disposal of the product. Product shall allow the use one of the approved methods for secure destruction of data/information including unclassified but sensitive information. Approved methods include NIST Special Publications 800- 88 Guidelines for Media Sanitization (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf) or the National Security Agency in the Media Destruction Guidance (https://www.nsa.gov/Resources/Media- Destruction-Guidance/).

c) The acquiring information technology is engineered for trustworthy and security that is consistent with the engineering-based trustworthy secure solutions as outlined in NIST Special Publication 800-160 Version 1, Revision 1 Engineering Trustworthy Secure Systems (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v1r1.pdf) and NIST Special Publication 800-160, Volume 2, Revision 1 Developing Cyber-Resilient Systems: A

Systems Security Engineering Approach (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v2r1.pdf).

d) The acquiring information technology complies with Office of Management and Budget

Memorandum M-07-18 Ensuring New Acquisitions Include Common Security Configurations and the Federal Acquisitions Regulations (FAR) 39.101(d) regulations require NIST common security configuration checklists including United States Government Configuration Baseline (USGCB) initiative. More information is available at National Checklist Program (NCP), (https://nvd.nist.gov/ncp/repository), the U.S. government repository of publicly available security checklists (or benchmarks) that provide detailed low-level guidance on setting the security configuration of operating systems and applications. The acquiring information technology considers the following requirements:

i. Software procured meets the standard installation, operation, maintenance, updates and/or patching of software shall not alter the configuration settings from the approved USGCB/other secure configuration.

ii. Applications designed for normal end users run in the standard user context without elevated system administration privileges.

iii. Supporting documentation or reference(s) that describes the security capabilities, the design and development processes and the testing and evaluation procedures used by the product or services being provided for this acquisition.

iv. Supporting documentation or reference(s) that describes all product or service updates and enhancements as they are implemented. The product or service supporting documentation could be the user and system administrator guides, which is documents the functional properties of the security controls employed to permit the analysis and testing of the security controls.

e) The acquiring information technology complies with the Homeland Security Presidential

Directive 12 (HSPD-12) Policy for a Common Identification Standard for Federal Employees and Contractors requirements from FAR 4.1302 stating: (a) In order to comply with Federal Information Processing Standard (FIPS) 201-3 Personal Identity Verification (PIV) of Federal Employees and Contractors (https://doi.org/10.6028/NIST.FIPS.201-3), agencies must purchase only approved personal identity verification products and services, (b) Agencies may acquire the approved products and services from the GSA, Federal Supply Schedule 70, Special Item Number (SIN) 132-62, HSPD-12 Product and Service Components, in accordance with ordering procedures outlined in FAR Subpart 8.4.

f) The acquiring information technology complies with Internet Protocol Version 6 (IPv6) requirements from FAR part 11.002 requirements that state the agency Chief Information Officer can waive this requirement provided the acquisition requirements documents the appropriate technical capabilities defined in the USGv6 Profile available in the NIST Special Publication (SP) 500-267 (https://www.nist.gov/programs-projects/usgv6-program) and the corresponding declarations of conformance. To meet this requirement each DOC acquisition of IP protocol technology must express requirements for IPv6 capabilities in terms of the USGv6 Profile (i.e., using the USGV6 Capabilities Check List) and vendors must be required to document their product’s support of the requested capabilities through the USGv6 test program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1) using the USGv6 Suppliers Declaration of Conformity.